Sécurité IT 2026-08-03

Niveau Vigilance — 52/100 — 2026-08-03

Journée « Vigilance » : 10 sujets classés, 1 des 10 premiers signalés comme activement exploités, 1 faille ajoutée au catalogue des vulnérabilités exploitées de la CISA. En tête : N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (65/100).

1. N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability — 65/100 (CVE-2026-18577)
2. open-emr openemr: OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component… — 36/100 (CVE-2026-39932)
3. CVE-2026-41452 — Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unau… — 36/100 (CVE-2026-41452)
4. CVE-2026-18602 — A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. — 34/100 (CVE-2026-18602)
5. CVE-2026-18614 — A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. — 34/100 (CVE-2026-18614)
6. bouncycastle bc-java: In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. — 28/100 (CVE-2026-8763)
7. bouncycastle bc-java: In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. — 28/100 (CVE-2026-59650)
8. bouncycastle bc-java: In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certific… — 28/100 (CVE-2026-58062)
9. CVE-2026-68979 — Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce au… — 23/100 (CVE-2026-68979)
10. CVE-2026-68980 — Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Con… — 9/100 (CVE-2026-68980)